but its not really managed as "roles" in that system, the assignment happens at the granularity of the resource and is quite flexible to create all of those combinations.